Malicious PDF — malware analysis report

Static analysis result for SHA-256 1cc5ab477390e93b…

MALICIOUS

PDF

483.3 KB Created: 2021-09-14 12:50:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 05b5fd1c9559fd1e284104b6f897a75e SHA-1: 398476105315ed33888da07022bdd660933f6361 SHA-256: 1cc5ab477390e93b1701f360094772c1742c8884c0423c05f77eff2530a9109b
216 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is identified as a malicious PDF by ClamAV and exhibits multiple suspicious findings related to embedded content and external links. The PDF contains numerous embedded URLs, many of which point to disposable hosting and are likely used for phishing or to redirect to malicious sites. The presence of multiple embedded PDF objects suggests a layered approach to evasion or payload delivery.

Machine Learning

  • Nyx PDF Classifier clean score 0.0150

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://resetimpianti.it/reset/public/file/xavaxufonebibizuxomawaju.pdf In PDF document text
    • https://primer-spb.ru/files/files/xilidovutulofedinumil.pdfIn PDF document text
    • http://loscogliodifavignana.it/userfiles/files/wajefubewobarizopogasole.pdfIn PDF document text
    • http://haenuri.net/ckupload/files/38388425434.pdfIn PDF document text
    • http://recko.ru/ckfinder/userfiles/files/bomedudeki.pdfIn PDF document text
    • https://abhrian.com/userfiles/files/xitomuk.pdfIn PDF document text
    • https://lecourbe.dk/userfiles/file/17756674144.pdfIn PDF document text
    • https://atputasbazes.lv/images/userfiles/files/nuwudezok.pdfIn PDF document text
    • http://www.pilartangguh.com/file/lokatesokulovagedelis.pdfIn PDF document text
    • http://blankheich.de/images/uploads/file/bitixepekexizodizaw.pdfIn PDF document text
    • https://natyabio.com/uploadfiles/33826517185.pdfIn PDF document text
    • http://turnyras.lt/Files/file/pejolowoz.pdfIn PDF document text
    • http://sjar-tech.com/uploadfile/file///2021091416281235.pdfIn PDF document text
    • https://defi128.phpascal.com/userfiles/files/55827084384.pdfIn PDF document text
    • http://andersonlawdecorah.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/naleluginaxevexi.pdfIn PDF document text
    • https://ozora.schaffsen.com/contents/file/kepadutuj.pdfIn PDF document text
    • http://mingmitrcoffee.com/user_img/files/voxazar.pdfIn PDF document text
    • http://canoeing.by/pics/files/dalunuxuvugawasemas.pdfIn PDF document text
    • http://poslovniimenik.net/firme_data/files/32651915447.pdfIn PDF document text
    • http://ilyxrace.com/userfiles/files/89740161559.pdfIn PDF document text
    • https://tungafilm.com/dorceiys/ckfinder/userfiles/files/7164653886.pdfIn PDF document text
    • http://congluc.com/upload/files/nonorebiga.pdfIn PDF document text
    • https://urbanlivin.lu/userfiles/files/10089939517.pdfIn PDF document text
    • http://canvangdientu.com/images/file/18909184275.pdfIn PDF document text
    • http://birons.net/wp-content/plugins/super-forms/uploads/php/files/d42652fbcdb8de7e8e22af80342a43bb/51495879223.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=jak+zrobi%C4%87+kopi%C4%99+zapasow%C4%85+systemu+androidPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d492.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD492 11672 bytes
SHA-256: d63968b0fe41eb0bcd6203012d76a365a3fa0e92eca968806ca147a7b0ad5bb3
font_01_sfnt_off0000ef81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF81 18244 bytes
SHA-256: c0f80ee8038c355ee597d198ae7b66644be00d477dd561346a2e920f0c2bfa83
font_02_sfnt_off00011d7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D7F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
polyglot_child_pdf_off00014182.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x14182 412587 bytes
SHA-256: 146b5448ef0a998cab51941f6407f1aa21d74bfced73f0a1e477c9e1e9277517
Detection
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Obfuscation or payload: unlikely
polyglot_child_pdf_off00028304.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x28304 330281 bytes
SHA-256: 072e4d862961e0f851e83eb7854c0a023370e226e943ab7b9d9718bae73fdd03
Detection
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Obfuscation or payload: unlikely
polyglot_child_pdf_off0003c486.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x3C486 247975 bytes
SHA-256: 5450f4b538e46c372c71e18ac8abbb259fa839b30a05c57d02f6e1ca99c8d7e6
Detection
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Obfuscation or payload: unlikely
polyglot_child_pdf_off00050608.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x50608 165669 bytes
SHA-256: 9766eaa19fdf5660c82c56eaf328d48fcc00a0b14bfa8380e71d38853138f712
Detection
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.